c5bf9e18943e676ddd7ad576e684fdaf497faf0e29588a32af3a2d5b6fafea8c

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b6707d76545da588fd430f52340ab3d_JaffaCakes118.html
Size

109KB
MD5

1b6707d76545da588fd430f52340ab3d
SHA1

991d88d404b7b295877cf8bd4083e00b652365ed
SHA256

c5bf9e18943e676ddd7ad576e684fdaf497faf0e29588a32af3a2d5b6fafea8c
SHA512

afe58439e2b5eddc34939b7d6b66cc3170fb0f3cb81365a6be87f18ec71d68e6a0edd3836f5bdaa0b6aff00f9060b3f33edea433fc149bdc0b71cdca4955952d
SSDEEP

1536:f+Orm46B50PFQxKCzYdLPciaffq+U9+hfu5qNV+/orsUVctV3ElkHXl3Tc/f485b:xXW52hBvclsVDc348a4wmu50J

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426000862"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46025261-37AA-11EF-9266-767D26DA5D32} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fdc11cb7cbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000087992b67707c2b4729eb77b832f960d6d28371ee8c09ca989edc5cab635e7a3000000000e80000000020000200000002785467a90cf117493917e67a528552e32817e2afcc300de9b25caa26edfc672200000007d387262e6b2d82f158366324d87925a3f5a742322ad2b5f6cfdfe0f70c6cd81400000000cd56e652b31f0de01d3a03b6d6ef3ea083028033a21f764b1d79f087aa587dfadee59c54d05488eab2d4109f750afcf1fb728f9caee2e316f8f9308b6bf0c70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b0961830bd697165160b1ab3a504c4489735241a00c2f0e42e51ff855b69078a000000000e80000000020000200000000b62af6fa92f929a64c799356011dd39d0104ec64bc6c1af7ff78a21da8848de90000000804e41613c9debcfde5c4dad2061a51bbaa582f4696aa7af6f3839d8f72fe2aaec32fe0150594a038e2454675b5f9b12a74e4d45608c434757e558c3d6c5ff6d0fcae5a12acd7145952bd2cd2e6e5a3a974c10847af193b660da46e9a8e380684a32e6c19b0595c2dd361c4301a1ea2106ecf7d792b8e02e71e5973fdfe8d6247a4e1966d6add3ee4f07cf3aa4e4608f400000004ed8bbac61c8f3e2a030216deccfa1f6ed4a491dc053f1b94dd4fdae0833ae3bd261b95c6dcf6e21dca1cbe8e7ff9d094f18ade6154854844ec11b99a75d35a4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2684	2968	iexplore.exe	28
PID 2968 wrote to memory of 2684	2968	iexplore.exe	28
PID 2968 wrote to memory of 2684	2968	iexplore.exe	28
PID 2968 wrote to memory of 2684	2968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b6707d76545da588fd430f52340ab3d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a59a3f6631765061370f11fd7787cab2

SHA1
a26703022759927248bf670cb73a3240043a9ca6

SHA256
b71516cf3378229728019481ee94f3b5c3a44f20bf2828718ada5986c1235c6e

SHA512
78c6874270aa8397cc7fa3f28d2f1b116ba27544136fdbc61330d2ded597071738b8b9630bcf79cacf02c86e459bf35a96989abcc57c8c75e7cbb4ca8180dfc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80e115351a64fafbacd55c177ab74509

SHA1
f7e7ebd43e11e769f08f67923931ce83f84924d8

SHA256
2af486a4196ffe08cd51a6733bdbaabedaa25de15d05920e0aee3c4e55a3b966

SHA512
b151fb669352ac3ef3325b1e749c9a12a6e2c0190b7436668f735be1c256fd8e1fb7f0582d528715c7b4f06296152a1d6c6aaf7448d0c934c2408bd475f04195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3655ef6e1a41a2802c345517f8c4585b

SHA1
d5407062a799a3ef43b9c3ede6d4ccbc618443a8

SHA256
52ebbbaef9e32bab3e56ce7ed10a9a28bf640e637996600ff1d4cc307d8722a9

SHA512
8a91dc93ce3130fb4c04a0c8dad2ca92a1df189aa9f906a043e750669dfb4054d5828d777e1c957b98784981e8663e05afbc0e32659833cc6f05fa888739d645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c13b054b0291cab91f1514d94e8455ea

SHA1
eb5add75a9be7237aa0fc1ba045d93d4eb909d10

SHA256
3c5aa10748e7bc97a9e81e927046d24c1161162935121f1e97ed3c0b44aca2f0

SHA512
a0bf67fa98be04ce69936b86aae4bb47f53d34daebd7dad4acd7b7c10061591e12388445c97722a3df353ccafa62eb2d8e0fb77294f758ad8161f4afa5b48f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
098875706a66d4da0c682faf9cd5f20a

SHA1
6152cbadca44181684eb829a7946fbe40b2244c7

SHA256
f30cb14b1862b116dd55b1d3b41b9b8756c08ababdc65f5c0b974861d324ea58

SHA512
d6607d4d08e5ef7343622599b23a2bd9efe6648563dcded19ba153b1723f9a26df62b1264a77c79fbbe252b99e57ae2786a7216a02bd324dd10f284a211d774f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bf5ea504fa96a740bee2781a232172e

SHA1
b9fe4a08ab891b87fb33d701e269cca645f1f633

SHA256
63312b00226411748145bbf2453aced5840f0ec310fcb78f5e556ff78a2b800e

SHA512
deaae4a0d3ea110357fabd25c97711d071f8503f01cac07a246096103828b0d2fcd8d6f79761ead7b386e8660b323c6a9eba83e0451ab8f848c3efc43cc01487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ae2c2ef2893fe51c619290e743e101

SHA1
078e647184a769a76dd1293672a532896a978236

SHA256
332b6492f0fd41cf74ad3e1f6750501e2b8a1c6e1bf2cdadfbf9ee5a6cd0d446

SHA512
8e46b7ad9bd1020d70cbae8f8dad3a69aa50c014ff6cd5cf1b27a9e00a2561004323e4087d4e89e7e9c1f846a921d6aae6323a09abdf691388ad6a0ac0ef6726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a940fd667920856e6e4420c7062133f3

SHA1
c1545327c753b43c116a3c764dd714a5b854e7a7

SHA256
eb343bef18122e1d8f31c64c6761b8092a3a3c90199710fe76b713d83ad0a25f

SHA512
97cabcffd271235f4969a8478e09b32462c63940527051abfa87112f18163c4e173cb89a19f0dda221b71dcdcfe14486217849bc170961d0e9655fdf2272191c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be3e6b9d36777c6b8afb674c72286e2b

SHA1
4adb3440b4c10c515efbb5fa14e57d27ae988023

SHA256
a13d1783c47a1ff402f6587db0d5e6fec4db94c543c68554c84f70af8473b37d

SHA512
8e8b526c008667ceb8914508f949c80476c166af6487451b65235067ce0a743787c557a734634a9155b21a19c51e4f705332972628f277892861309674436c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
140a1bc98dda0a635cee6fd7f4938b84

SHA1
9bdf26ca636cb835ff2fdd2b1ef43908f048009b

SHA256
d16e3c15b93a9fb0b2fc87cc73b6433f681c7e04c80277db42d6e4cb9159e4e2

SHA512
295a31d180c7ee38a9063f7982508739bc53ed8e15103a106fef416b302d8bba1d242fd0cf10be23bba02702f649e198a590aea10960dd7cf1db307828adfe32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b9cffd6ec69f70f6417bb2e9afa4836

SHA1
dd048c95eee4d6543b64192aa47062c585662901

SHA256
a0d1328332c96ac2acf8c3e21203c211a9c7f65c5c5496838fea3f3619cf7633

SHA512
8f25174457501dffadefe4ceb92c6f04c3856897a0d1956430ab7dd062de17620e174e52d4b37728c0dc00e599ffaf7e2c047cbee69b9beec8d96eb655e17b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
680cd73b90bda6dd3c02ca3a74bff17a

SHA1
38ee86e93f334f70d90755fe5b367cf6e93bb305

SHA256
6e125c2b646d5ad8694d0f1e120b9e51042ab06187d47a571787b08de84a0df1

SHA512
55d95cca01a161f09585fa21d2d59c9a4b8e5a009fd91cd4a11a273c23f0d9a21ef09a945cd0a1a06f688dc7ed27b8fffe33b70a613432bf8ffc8cad3a662f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1e0c9b4addcfd8f4aab0892a3df1846

SHA1
b9eec47b264063f043afe88fc88c0e361a515560

SHA256
c0a9ee3cf5f9784afd509200ab85fd8e1c07d0be9ae31a8b8512a480b8bd628e

SHA512
bfcbb5d15a1ab66250eb32edfdb2a18e78b18e9d0a514af87fbba15ddae9e3e63aa9133e58ff302ddaf15f1789dddb3f6a80eda3e1f010eff16121fc3a5e726e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9194233881a19a39a72b3a1bd7aa346

SHA1
225e447c9e217aa8b0655e760ff8c2fc34e135ec

SHA256
542607b337dec8ef9696c6f6eff82d72086f57832af5185bf178ea99abf6717a

SHA512
09e72c5fba4b7aee85d73ce3cbf6bda1b51613018af85ceba1e91d359548926e1c5cb16a1db2ccf00b5d0cd97cdf0ee523ccbe3265fb58df69907d9af1b72a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92053ca527315411037542c7a6060970

SHA1
2242065fbb9ef6aefb83abe0208ef3eb1471907b

SHA256
30054b11fe3f984932923af5e5db4ce793732f101c9fc438ddec66d9132f6290

SHA512
66a5c7eb73f73c8b4407ad81271b55409e10ecadfd3b24ae91754a4676f0c96f625a7d86709af5186e32cb6369471e5f5f32e6b798add4729a2337c055fed09c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecc6b49c29f9d38fe68c430ffdeaac75

SHA1
3742622c62b0903d2cc416192e8c8ccf894fe11d

SHA256
832c686aab086e8836d6587d276fd2bcd374f6309c2043ddf68a5ba5098f761e

SHA512
a20c6f5c63ec58297141933b06d60ac51460327db81566aac9dc7d09aa0143b5d262260a6e2754bae689e44c977ebe42a10f8d050fddefe8086ceebcfb90efee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b003a99a1a09607dbcd09caa9b84b878

SHA1
d79c5176af7b45cd37dbbea20066cdb4df4f0df8

SHA256
f43f125c2a244a029d2ff9320fbb82b290c3b62cf3e4447fdc9d80d6c8905e02

SHA512
55235bd5df588e263fd3bfe36956cb69ec1d5b1c3b19c93d61a8df6f19aa6fd74c0efdc9d01e661de5a078a09ffc8b7b3a6b1193cbbc298bbfdb6864128893ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c14ee731d8e61a8780a07f89f698ca8e

SHA1
eea690e36fd7cac3cd664f8556903f41ef8d251f

SHA256
a90e07a4cf19fff03f36d26d9996eb2c4eb70638f29da043a72dc0a606a41d67

SHA512
00aad0b27cc9917fa06526112633c3ab859ac63cbaf4be7de7864d09d2bab15396ce402eb2239558e67f4a6dbb97fec30a33ade3a311df5a045e3ba5c7b1945d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8440.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8441.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit